beatrina 0.8.6

package/failsafe/plugins.R

@@ -0,0 +1,809 @@
+# plugins.R — the plugin store: things the notebook can import, and the one
+# door they come through.
+#
+# ── what a plugin is ────────────────────────────────────────────────────────
+#
+# A PLUGIN IS DATA A KNOWN CONSUMER READS. IT IS NEVER CODE. That sentence is
+# the whole trust model, and it is what lets the mechanism be this small. A
+# citation style is XML that pandoc parses; an editor theme is a palette the
+# stylesheet applies. Neither can call anything. The notebook page runs under
+# a CSP whose only script is its own bundle; a plugin kind whose payload was
+# JavaScript would need a second script origin and would be the Chrome
+# extension hole in a new coat (deleted in 0.38.0; CLAUDE.md "One transport").
+# So the table of kinds is CLOSED — each kind names its consumer, its file
+# types, its size cap and its validator — and "js" is not a row. A kind that
+# is not in the table cannot be installed, whatever a manifest claims.
+#
+# ── where plugins live: three layers, like .libPaths() ──────────────────────
+#
+#   user     R_user_dir("carmar","data")/plugins/<kind>/<id>/   the person's own; the ONLY layer written
+#   system   $CARMAR_PLUGIN_DIR/<kind>/<id>/                     an administrator's set, read-only
+#   shipped  <kernel>/plugins/<kind>/<id>/                       what the kernel came with, read-only
+#
+# Searched in that order; the first OK copy of an id wins ("active"), so a
+# person's copy shadows the department's, which shadows the bundle — exactly
+# as a user library shadows the site library in R. A BROKEN copy never wins:
+# integrity is checked on every listing, and a plugin whose payload no longer
+# matches its manifest is listed with the reason and used by nothing.
+#
+# One plugin is one folder: a manifest and its payload. The manifest is
+# written by the kernel at install (or by tools/plugins/stamp.mjs for the
+# shipped set) and READ BACK, never trusted: id must equal the folder name,
+# kind must equal the folder above, every file must be a bare name inside the
+# folder, exist, sit under the size cap and hash to what the manifest says.
+#
+# ── the one door, and who may open it ───────────────────────────────────────
+#
+# `plugin_install` is the only write. Three sources: a kind's REGISTRY (the
+# CSL repository, by name), a URL on a permitted host, or the TEXT of a file
+# the person picked in the page (the offline door — nothing here needs a
+# native chooser, and no path travels on the wire). Every install stages in a
+# temp folder, validates there, and is renamed into place, so a half-download
+# or a file that fails its kind's check is never a plugin. serve.R makes
+# install/remove page-only in BOTH senses (PAGE_ONLY_CLASSES + AGENT_REFUSED)
+# and audits each: changing what a machine renders with is the person's
+# decision, made visibly. Listing and reading are open to any socket — an
+# agent that knows which styles exist writes `csl: apa.csl` instead of
+# guessing.
+#
+# ── the administrator's policy ───────────────────────────────────────────────
+#
+#   CARMAR_PLUGIN_POLICY=/etc/carmar/plugin-policy.json   the file (wins where both are set)
+#   CARMAR_PLUGIN_DIR=/opt/carmar/plugins                  the system layer
+#   CARMAR_PLUGIN_INSTALL=user|none                        may the person install? (default user)
+#   CARMAR_PLUGIN_SOURCES=host,host|none                   hosts a URL/registry install may fetch from
+#   CARMAR_PLUGIN_KINDS=csl,theme                          which kinds exist at all
+#
+# Same doctrine as ai-policy.R: the honest scope is the feature. The kernel
+# owns every fetch and every write here, so unlike an AI policy this one is
+# ENFORCEMENT — a host not on the list is never contacted, `install: none`
+# means the user layer is neither written nor read. And the three-state rule
+# holds: a policy that names nothing permits everything; one that names only
+# junk is a startup error, never a silent "all". `carmar_plugin_policy()` is
+# pure; serve.R joins its `errors` to the startup gate.
+#
+# Nothing here runs at start. The kernel lists folders when asked; nothing is
+# read until a consumer asks; the network is touched only inside an install.
+
+`%||%` <- if (exists("%||%")) `%||%` else function(a, b) if (is.null(a)) b else a
+
+PLUGIN_ID_RE <- "^[a-z0-9][a-z0-9._-]{0,63}$"
+PLUGIN_FILE_RE <- "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$"
+PLUGIN_MANIFEST <- "plugin.json"
+PLUGIN_MANIFEST_MAX_BYTES <- 65536L
+PLUGIN_FETCH_TIMEOUT_S <- 20L
+PLUGIN_POLICY_DEFAULT_FILE <- "/etc/carmar/plugin-policy.json"
+PLUGIN_SYSTEM_DEFAULT_DIR <- "/etc/carmar/plugins"
+
+# THIS LIST IS A CROSS-LANGUAGE CONTRACT with `EDITOR_TOKENS` in
+# lib/editor-themes.js; test/plugins.test.mjs reads both and fails if they
+# diverge. A theme plugin may set exactly these.
+THEME_TOKENS <- c(
+  "--ed-bg", "--ed-fg", "--ed-gutter", "--ed-gutter-bg", "--ed-line", "--ed-sel",
+  "--ed-caret", "--ed-border", "--ed-bar", "--ed-brmatch",
+  "--rtok-com", "--rtok-doc", "--rtok-section", "--rtok-tag", "--rtok-str", "--rtok-num",
+  "--rtok-kw", "--rtok-const", "--rtok-fn", "--rtok-ns", "--rtok-arg", "--rtok-op",
+  "--rtok-infix", "--rtok-paren")
+THEME_WASH_TOKENS <- c("--ed-line", "--ed-sel", "--ed-brmatch")
+
+# ── the latex kind's vocabulary ─────────────────────────────────────────────
+#
+# THE SECOND CROSS-LANGUAGE CONTRACT, with `TEMPLATE_KEYS` / `CITE_STYLES` /
+# `TOP_LEVELS` in lib/latex-templates.js; test/plugins.test.mjs reads both.
+#
+# A template plugin may set exactly these keys. It carries no `.cls` — a
+# journal class is on the author's TeX installation or it is not, and shipping
+# someone's class file would be redistribution with a licence question
+# attached. What travels is the NAME of the class and the preamble lines that
+# go with it.
+LATEX_TEMPLATE_KEYS <- c("label", "documentclass", "classOptions", "citeStyle",
+                         "citePackage", "topLevel", "preamble", "description", "version")
+LATEX_CITE_STYLES <- c("natbib", "biblatex", "plain")
+LATEX_TOP_LEVELS <- c("section", "chapter")
+LATEX_CLASS_RE <- "^[A-Za-z][A-Za-z0-9._-]{0,39}$"
+LATEX_OPTION_RE <- "^[A-Za-z0-9][A-Za-z0-9 =.,%*-]{0,79}$"
+# `citeStyle` and `citePackage` are TWO decisions that look like one.
+# `citeStyle` says which commands the body gets (\\parencite or \\citep or
+# \\cite); `citePackage` says how the engine is loaded. latexDocument fused
+# them until apa7, which needs biblatex's commands AND [style=apa] — with one
+# key it would have loaded biblatex twice with contradictory options.
+LATEX_CITE_PACKAGE_RE <- "^\\\\usepackage(\\[[^]]{0,120}\\])?\\{[A-Za-z0-9,._-]{1,60}\\}$"
+LATEX_PREAMBLE_MAX_LINES <- 200L
+LATEX_PREAMBLE_MAX_CHARS <- 400L
+
+# WHY THIS ROW HAS A DENY-LIST AND THE OTHER TWO DO NOT.
+#
+# A CSL style is XML pandoc parses; it cannot call anything. A theme is a map
+# of colours. A LaTeX preamble is CODE — not code CarmaR runs (the kernel
+# never compiles a .tex; latex.js only writes one) but code the AUTHOR'S TeX
+# engine runs when they build the paper. That is a weaker guarantee than the
+# other two rows make, and it is written here rather than left to be inherited
+# by proximity.
+#
+# What is left of it after the deny-list: shell escape is off by default in
+# every current TeX distribution and needs --shell-escape on the command line,
+# and the person compiling is the person who chose the template. What the
+# list buys is that a template cannot ASK for those doors, so an author who
+# does pass --shell-escape for an unrelated reason is not handing a downloaded
+# file a shell. File inclusion is refused for the same reason a plugin's files
+# must be bare names inside its folder: a template is one file, not a foothold
+# for reading the author's disk into their PDF.
+#
+# A NOTE ON THE BOUNDARY, because the obvious one is wrong. A TeX control word
+# ends at the first NON-LETTER, which is not what `\\b` means: in `\\openout1`
+# the `t` and the `1` are both word characters, so `\\bopenout\\b` does not
+# match the commonest way anyone writes it. `(?![A-Za-z])` is the real rule.
+# It also has to cut both ways — `\\inputencoding` and `\\includegraphics` are
+# ordinary and must NOT be caught by the `input`/`include` row, while
+# `\\readline` must be caught by the file row, which is why only that row
+# tolerates a suffix.
+LATEX_FORBIDDEN <- list(
+  list(re = "\\\\write[[:space:]]*18", why = "runs a shell command"),
+  list(re = "\\\\(ShellEscape|directlua|luadirect|pdfprimitive|javascript)(?![A-Za-z])", why = "runs code outside TeX"),
+  list(re = "\\\\(openout|openin|read|write)[a-z]*(?![A-Za-z])", why = "reads or writes files"),
+  list(re = "\\\\(input|include|includeonly|subfile|subimport|import)(?![A-Za-z])", why = "pulls in another file"),
+  list(re = "shellesc|\\bshell-?escape", why = "asks for shell escape"),
+  list(re = "\\\\documentclass|\\\\begin[[:space:]]*\\{document\\}", why = "is the document's, not the preamble's")
+)
+
+#' The first forbidden construct in `text`, as a sentence, or "" when clean.
+latex_forbidden_reason <- function(text) {
+  for (rule in LATEX_FORBIDDEN) {
+    if (any(grepl(rule$re, text, perl = TRUE))) return(rule$why)
+  }
+  ""
+}
+
+# ── the kinds table ─────────────────────────────────────────────────────────
+#
+# Closed, by design. A row is: what the payload is, who reads it, how big it
+# may be, how it is checked, and — for a kind with a public registry — where
+# it is searched and fetched by name. `validate(dir, file)` returns
+# list(ok, error, name, version, requires) where `requires` names OTHER
+# plugins of the same kind this one renders through (a dependent CSL style's
+# parent); an install completes them from the registry.
+
+PLUGIN_KINDS <- list(
+  csl = list(
+    label = "Citation styles",
+    consumer = "pandoc renders citations and the reference list with it; it is placed beside a saved document.",
+    extension = "csl",
+    max_bytes = 2000000,
+    license = "CC BY-SA 3.0",
+    registry = function() list(base = CSL_STYLE_BASE(), index = CSL_INDEX_URL()),
+    validate = function(dir, file) {
+      path <- file.path(dir, file)
+      if (!csl_looks_like_style(path)) return(list(ok = FALSE, error = "did not arrive as a CSL style"))
+      info <- csl_info(path)
+      parent <- sub("\\.csl$", "", info$parent)
+      if (nzchar(parent) && !grepl(PLUGIN_ID_RE, parent)) {
+        return(list(ok = FALSE, error = "names a parent style this kernel will not fetch"))
+      }
+      head_text <- paste(readLines(path, n = 80L, warn = FALSE, encoding = "UTF-8"), collapse = "\n")
+      updated <- regmatches(head_text, regexpr("<updated>[^<]+</updated>", head_text))
+      version <- if (length(updated)) substr(gsub("</?updated>", "", updated[[1L]]), 1L, 10L) else ""
+      list(ok = TRUE, name = info$title, version = version,
+           requires = if (nzchar(parent)) parent else character(0))
+    }),
+  theme = list(
+    label = "Editor themes",
+    consumer = "the editor: chunks, console, script editor and R code in prose.",
+    extension = "json",
+    max_bytes = 65536,
+    license = "",
+    registry = NULL,
+    validate = function(dir, file) {
+      doc <- tryCatch(jsonlite::fromJSON(file.path(dir, file), simplifyVector = FALSE), error = function(e) e)
+      if (inherits(doc, "error")) return(list(ok = FALSE, error = paste0("is not valid JSON: ", conditionMessage(doc))))
+      label <- doc$label
+      if (!is.character(label) || length(label) != 1L || !nzchar(trimws(label)) || nchar(label) > 60L) {
+        return(list(ok = FALSE, error = "needs a `label` of up to 60 characters"))
+      }
+      if (!is.logical(doc$dark) || length(doc$dark) != 1L || is.na(doc$dark)) {
+        return(list(ok = FALSE, error = "needs `dark`: true or false"))
+      }
+      vars <- doc$vars
+      if (!is.list(vars) || is.null(names(vars)) || !length(vars)) return(list(ok = FALSE, error = "needs a `vars` object of editor tokens"))
+      unknown <- setdiff(names(vars), THEME_TOKENS)
+      if (length(unknown)) return(list(ok = FALSE, error = paste0("sets tokens the editor does not have: ", paste(head(unknown, 3L), collapse = ", "))))
+      if (!all(c("--ed-bg", "--ed-fg") %in% names(vars))) return(list(ok = FALSE, error = "must set at least --ed-bg and --ed-fg"))
+      bad <- vapply(names(vars), function(k) {
+        v <- vars[[k]]
+        if (!is.character(v) || length(v) != 1L) return(TRUE)
+        hex <- grepl("^#[0-9a-fA-F]{6}$", v)
+        wash <- k %in% THEME_WASH_TOKENS && grepl("^rgba\\(\\s*[0-9]{1,3}\\s*,\\s*[0-9]{1,3}\\s*,\\s*[0-9]{1,3}\\s*,\\s*(0|1|0?\\.[0-9]{1,4})\\s*\\)$", v)
+        !(hex || wash)
+      }, logical(1))
+      if (any(bad)) return(list(ok = FALSE, error = paste0("colour for ", names(vars)[bad][[1L]], " must be #rrggbb (a wash may be rgba())")))
+      version <- doc$version
+      version <- if (is.character(version) && length(version) == 1L && !is.na(version)) substr(version, 1L, 40L) else ""
+      list(ok = TRUE, name = trimws(label), version = version, requires = character(0))
+    }),
+  latex = list(
+    label = "LaTeX templates",
+    consumer = "the LaTeX export: it sets the document class, its options and the preamble of the .tex that is written.",
+    extension = "json",
+    max_bytes = 65536,
+    license = "",
+    registry = NULL,
+    validate = function(dir, file) {
+      doc <- tryCatch(jsonlite::fromJSON(file.path(dir, file), simplifyVector = FALSE), error = function(e) e)
+      if (inherits(doc, "error")) return(list(ok = FALSE, error = paste0("is not valid JSON: ", conditionMessage(doc))))
+      if (!is.list(doc) || is.null(names(doc)) || !length(doc)) return(list(ok = FALSE, error = "is not a template object"))
+      unknown <- setdiff(names(doc), LATEX_TEMPLATE_KEYS)
+      if (length(unknown)) {
+        return(list(ok = FALSE, error = paste0("sets keys a template does not have: ", paste(utils::head(unknown, 3L), collapse = ", "))))
+      }
+      one <- function(v, max) is.character(v) && length(v) == 1L && !is.na(v) && nzchar(trimws(v)) && nchar(v) <= max
+      strings <- function(v) {
+        if (is.null(v)) return(character(0))
+        if (!is.list(v) && !is.character(v)) return(NULL)
+        out <- unlist(v, use.names = FALSE)
+        if (!length(out)) return(character(0))
+        if (!is.character(out) || anyNA(out)) return(NULL)
+        out
+      }
+
+      if (!one(doc$label, 60L)) return(list(ok = FALSE, error = "needs a `label` of up to 60 characters"))
+      if (!one(doc$documentclass, 40L) || !grepl(LATEX_CLASS_RE, doc$documentclass)) {
+        return(list(ok = FALSE, error = "needs a `documentclass` that is a plain class name (letters, digits, . _ -)"))
+      }
+
+      opts <- strings(doc$classOptions)
+      if (is.null(opts)) return(list(ok = FALSE, error = "`classOptions` must be a list of strings"))
+      if (length(opts) > 12L) return(list(ok = FALSE, error = "names more class options than a class takes"))
+      bad <- opts[!grepl(LATEX_OPTION_RE, opts)]
+      if (length(bad)) return(list(ok = FALSE, error = paste0("has a class option that is not a plain option: ", bad[[1L]])))
+
+      pre <- strings(doc$preamble)
+      if (is.null(pre)) return(list(ok = FALSE, error = "`preamble` must be a list of lines"))
+      if (length(pre) > LATEX_PREAMBLE_MAX_LINES) {
+        return(list(ok = FALSE, error = sprintf("has a preamble longer than %d lines", LATEX_PREAMBLE_MAX_LINES)))
+      }
+      long <- pre[nchar(pre) > LATEX_PREAMBLE_MAX_CHARS]
+      if (length(long)) return(list(ok = FALSE, error = sprintf("has a preamble line longer than %d characters", LATEX_PREAMBLE_MAX_CHARS)))
+
+      # The deny-list, over everything that reaches the .tex. See LATEX_FORBIDDEN.
+      why <- latex_forbidden_reason(c(doc$documentclass, opts, pre, as.character(doc$citePackage %||% "")))
+      if (nzchar(why)) return(list(ok = FALSE, error = paste0("contains LaTeX that ", why, ", which a template may not do")))
+
+      if (!is.null(doc$citeStyle) && !(one(doc$citeStyle, 20L) && doc$citeStyle %in% LATEX_CITE_STYLES)) {
+        return(list(ok = FALSE, error = paste0("`citeStyle` must be one of ", paste(LATEX_CITE_STYLES, collapse = ", "))))
+      }
+      if (!is.null(doc$citePackage) && !(one(doc$citePackage, 200L) && grepl(LATEX_CITE_PACKAGE_RE, doc$citePackage))) {
+        return(list(ok = FALSE, error = "`citePackage` must be a single \\usepackage line"))
+      }
+      if (!is.null(doc$topLevel) && !(one(doc$topLevel, 20L) && doc$topLevel %in% LATEX_TOP_LEVELS)) {
+        return(list(ok = FALSE, error = paste0("`topLevel` must be one of ", paste(LATEX_TOP_LEVELS, collapse = ", "))))
+      }
+      if (!is.null(doc$description) && !one(doc$description, 200L)) {
+        return(list(ok = FALSE, error = "`description` must be a sentence of up to 200 characters"))
+      }
+
+      version <- doc$version
+      version <- if (is.character(version) && length(version) == 1L && !is.na(version)) substr(version, 1L, 40L) else ""
+      list(ok = TRUE, name = trimws(doc$label), version = version, requires = character(0))
+    })
+)
+
+plugin_kind_ok <- function(kind) is.character(kind) && length(kind) == 1L && !is.na(kind) && kind %in% names(PLUGIN_KINDS)
+plugin_id_ok <- function(id) is.character(id) && length(id) == 1L && !is.na(id) && grepl(PLUGIN_ID_RE, id)
+plugin_file_ok <- function(file) is.character(file) && length(file) == 1L && !is.na(file) && grepl(PLUGIN_FILE_RE, file) &&
+  !grepl("\\.\\.", file, fixed = FALSE)
+
+policy_split <- if (exists("policy_split")) policy_split else function(value) {
+  parts <- trimws(unlist(strsplit(value %||% "", "[,[:space:]]+")))
+  parts[nzchar(parts)]
+}
+
+#' The host of a URL, lower-cased, or "" when it has none.
+url_host <- function(url) {
+  m <- regmatches(url, regexpr("^https?://[^/?#]+", url))
+  if (!length(m)) return("")
+  tolower(sub("^https?://", "", sub(":[0-9]+$", "", m[[1L]])))
+}
+
+#' The hosts an install may fetch from when no policy names any: the
+#' registries of the kinds themselves. Computed, not written down, so a test
+#' pointing the CSL registry at 127.0.0.1 permits 127.0.0.1 without a second
+#' override.
+plugin_default_hosts <- function() {
+  hosts <- unlist(lapply(PLUGIN_KINDS, function(k) {
+    if (is.null(k$registry)) return(character(0))
+    r <- k$registry()
+    c(url_host(r$base), url_host(r$index))
+  }))
+  unique(hosts[nzchar(hosts)])
+}
+
+#' Read the administrator's plugin policy.
+#'
+#' @param env a getter with `Sys.getenv`'s signature; injected for tests.
+#' @param default_file the file read when CARMAR_PLUGIN_POLICY is unset, if it exists.
+#' @param default_dir the system layer when CARMAR_PLUGIN_DIR is unset, if it exists.
+#' @return list(set, source, install, sources, network, kinds, unknown, note,
+#'   system_dir, errors). `kinds` is the permitted kinds — every kind when
+#'   unset. `sources` is the permitted hosts; `network` FALSE when none may
+#'   be contacted (`sources: none`, or an empty valid list).
+#'
+#'   Three states, as in ai-policy.R: names nothing → everything; names
+#'   something valid → exactly that; names ONLY junk → an error, because an
+#'   empty allow-list that fails open is the bug the AI policy suite caught.
+carmar_plugin_policy <- function(env = Sys.getenv, default_file = PLUGIN_POLICY_DEFAULT_FILE,
+                                 default_dir = PLUGIN_SYSTEM_DEFAULT_DIR) {
+  errors <- character(0)
+  source <- ""
+  install <- ""
+  sources_raw <- NULL
+  kinds_raw <- NULL
+  note <- ""
+  system_dir <- trimws(env("CARMAR_PLUGIN_DIR", ""))
+  if (!nzchar(system_dir) && nzchar(default_dir) && dir.exists(default_dir)) system_dir <- default_dir
+
+  path <- trimws(env("CARMAR_PLUGIN_POLICY", ""))
+  if (!nzchar(path) && nzchar(default_file) && file.exists(default_file)) path <- default_file
+  if (nzchar(path)) {
+    source <- path
+    if (!file.exists(path)) {
+      errors <- c(errors, paste0("CARMAR_PLUGIN_POLICY names a file that does not exist: ", path))
+    } else {
+      doc <- tryCatch(jsonlite::fromJSON(path, simplifyVector = TRUE), error = function(e) e)
+      if (inherits(doc, "error")) {
+        errors <- c(errors, paste0("CARMAR_PLUGIN_POLICY is not valid JSON: ", conditionMessage(doc)))
+      } else {
+        install <- trimws(as.character(doc$install %||% "")[1] %||% "")
+        if (!is.null(doc$sources)) sources_raw <- as.character(unlist(doc$sources))
+        if (!is.null(doc$kinds)) kinds_raw <- as.character(unlist(doc$kinds))
+        note <- trimws(as.character(doc$note %||% "")[1] %||% "")
+        if (is.na(note)) note <- ""
+        if (is.na(install)) install <- ""
+        d <- trimws(as.character(doc$system_dir %||% "")[1] %||% "")
+        if (!is.na(d) && nzchar(d)) system_dir <- d
+      }
+    }
+  } else {
+    if (nzchar(env("CARMAR_PLUGIN_INSTALL", ""))) { source <- "env"; install <- trimws(env("CARMAR_PLUGIN_INSTALL", "")) }
+    if (nzchar(env("CARMAR_PLUGIN_SOURCES", ""))) { source <- "env"; sources_raw <- policy_split(env("CARMAR_PLUGIN_SOURCES", "")) }
+    if (nzchar(env("CARMAR_PLUGIN_KINDS", ""))) { source <- "env"; kinds_raw <- policy_split(env("CARMAR_PLUGIN_KINDS", "")) }
+  }
+
+  if (!nzchar(install)) install <- "user"
+  if (!install %in% c("user", "none")) {
+    errors <- c(errors, paste0("The plugin policy's `install` must be \"user\" or \"none\", not \"", install, "\"."))
+    install <- "user"
+  }
+
+  # Kinds: three states.
+  kinds_named <- unique(trimws(kinds_raw %||% character(0)))
+  kinds_named <- kinds_named[nzchar(kinds_named)]
+  unknown <- setdiff(kinds_named, names(PLUGIN_KINDS))
+  kinds <- if (length(kinds_named)) intersect(kinds_named, names(PLUGIN_KINDS)) else names(PLUGIN_KINDS)
+  if (length(kinds_named) && !length(kinds)) {
+    errors <- c(errors, paste0("The plugin policy permits no plugin kind at all (unrecognised: ",
+                               paste(unknown, collapse = ", "), "). Name at least one of ",
+                               paste(names(PLUGIN_KINDS), collapse = ", "), ", or remove the policy."))
+  }
+
+  # Sources: an absent list means the kinds' own registries; "none" means no
+  # network at all; anything else is an exact host list (an administrator's
+  # mirror). A host is a host — no scheme, no path — and https is required
+  # of every fetch regardless of the list.
+  network <- TRUE
+  sources <- character(0)
+  if (is.null(sources_raw)) {
+    sources <- plugin_default_hosts()
+  } else {
+    named <- unique(tolower(trimws(sources_raw)))
+    named <- named[nzchar(named)]
+    if (identical(named, "none") || !length(named)) {
+      network <- FALSE
+    } else {
+      bad <- named[!grepl("^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$", named)]
+      if (length(bad)) errors <- c(errors, paste0("The plugin policy's `sources` must be bare host names: ", paste(bad, collapse = ", ")))
+      sources <- setdiff(named, bad)
+      if (!length(sources)) network <- FALSE
+    }
+  }
+
+  set <- nzchar(source) && !length(errors)
+  if (length(errors)) { install <- "user"; kinds <- names(PLUGIN_KINDS); sources <- plugin_default_hosts(); network <- TRUE }
+  note <- gsub("[[:cntrl:]]", " ", note)
+  note <- trimws(substr(note, 1L, 400L))
+
+  list(set = set, source = source, install = install, sources = sources, network = network,
+       kinds = kinds, unknown = unknown, note = note, system_dir = system_dir, errors = errors)
+}
+
+#' The sentence shown when the policy refuses something.
+plugin_policy_reason <- function(policy, what = "install") {
+  base <- switch(what,
+    install = "This CarmaR is configured so that plugins are not installed by users; the set is fixed by the deployment.",
+    network = "This CarmaR is configured to fetch no plugins from the network; a plugin arrives as a file.",
+    host = sprintf("This CarmaR is configured to fetch plugins only from: %s.", paste(policy$sources, collapse = ", ")),
+    kind = "This CarmaR is configured without that plugin kind.",
+    "This CarmaR's plugin policy refuses that.")
+  if (nzchar(policy$note)) paste(base, policy$note) else base
+}
+
+# ── layers and paths ─────────────────────────────────────────────────────────
+
+plugin_user_dir <- function() file.path(tools::R_user_dir("carmar", "data"), "plugins")
+
+#' The layers, in precedence order. The user layer is absent under
+#' `install: none` — not read-only, ABSENT, because "the set is fixed by the
+#' deployment" and a person's earlier imports quietly outranking it would
+#' make that sentence false.
+plugin_layers <- function(here, policy) {
+  layers <- list()
+  if (identical(policy$install, "user")) layers <- c(layers, list(list(name = "user", dir = plugin_user_dir(), writable = TRUE)))
+  if (nzchar(policy$system_dir)) layers <- c(layers, list(list(name = "system", dir = policy$system_dir, writable = FALSE)))
+  c(layers, list(list(name = "shipped", dir = file.path(here, "plugins"), writable = FALSE)))
+}
+
+#' A path INSIDE `base`, or NULL. The regexes on id and file already forbid a
+#' separator and `..`; this is the second lock — resolved paths, compared —
+#' so a symlink or an encoding trick a regex did not foresee still cannot
+#' reach out of the layer. `mustWork = FALSE` because the target may not
+#' exist yet at install.
+plugin_contained <- function(base, ...) {
+  if (!dir.exists(base)) return(NULL)
+  root <- normalizePath(base, winslash = "/", mustWork = TRUE)
+  parts <- c(...)
+  if (!length(parts) || !all(vapply(parts, function(x) is.character(x) && length(x) == 1L && !is.na(x) &&
+                                      !grepl("[/\\\\]|^\\.\\.?$", x), logical(1)))) return(NULL)
+  path <- file.path(root, paste(parts, collapse = "/"))
+  # An existing target is resolved through any symlink before the check;
+  # one that does not exist yet is a plain child of the resolved root by
+  # construction (no separator, no dot segment — refused above).
+  if (file.exists(path)) path <- normalizePath(path, winslash = "/", mustWork = TRUE)
+  if (!identical(path, root) && !startsWith(path, paste0(root, "/"))) return(NULL)
+  path
+}
+
+plugin_digest <- function(path) {
+  if (exists("sha256sum", asNamespace("tools"))) {
+    list(algo = "sha256", value = unname(tools::sha256sum(path)))
+  } else {
+    list(algo = "md5", value = unname(tools::md5sum(path)))
+  }
+}
+
+# ── the manifest ────────────────────────────────────────────────────────────
+
+#' Build the manifest for a validated payload sitting in `dir`.
+plugin_manifest_for <- function(dir, kind, id, files, info, source, license = "") {
+  digests <- lapply(files, function(f) plugin_digest(file.path(dir, f)))
+  names(digests) <- files
+  algo <- digests[[1L]]$algo
+  list(
+    id = id, kind = kind,
+    name = substr(info$name %||% id, 1L, 200L),
+    version = info$version %||% "",
+    file = files[[1L]], files = I(files),
+    requires = I(as.character(info$requires %||% character(0))),
+    license = license %||% "",
+    source = source,
+    digest = algo,
+    sha256 = if (identical(algo, "sha256")) lapply(digests, function(d) d$value) else NULL,
+    md5 = if (identical(algo, "md5")) lapply(digests, function(d) d$value) else NULL,
+    bytes = sum(vapply(files, function(f) as.numeric(file.info(file.path(dir, f))$size), numeric(1))),
+    installed = format(Sys.time(), "%Y-%m-%dT%H:%M:%SZ", tz = "UTC"))
+}
+
+plugin_manifest_write <- function(dir, manifest) {
+  manifest <- manifest[!vapply(manifest, is.null, logical(1))]
+  writeLines(jsonlite::toJSON(manifest, auto_unbox = TRUE, pretty = TRUE, null = "null"),
+             file.path(dir, PLUGIN_MANIFEST), useBytes = TRUE)
+}
+
+#' Read and CHECK one plugin folder. Returns a row-shaped list with
+#' `status` "ok" or "broken" and a `reason`; a folder is never trusted for
+#' what its manifest claims.
+plugin_inspect <- function(layer, kind, id) {
+  dir <- plugin_contained(file.path(layer$dir, kind), id)
+  row <- list(kind = kind, id = id, name = id, version = "", layer = layer$name, dir = dir %||% "",
+              file = "", files = character(0), requires = character(0), source = "", license = "",
+              installed = "", bytes = 0, status = "broken", reason = "", verified = FALSE)
+  if (is.null(dir) || !dir.exists(dir)) { row$reason <- "the folder is outside its layer"; return(row) }
+  mpath <- file.path(dir, PLUGIN_MANIFEST)
+  if (!file.exists(mpath)) { row$reason <- "no plugin.json"; return(row) }
+  if (file.info(mpath)$size > PLUGIN_MANIFEST_MAX_BYTES) { row$reason <- "plugin.json is too large to be one"; return(row) }
+  m <- tryCatch(jsonlite::fromJSON(mpath, simplifyVector = TRUE), error = function(e) e)
+  if (inherits(m, "error")) { row$reason <- paste0("plugin.json is not valid JSON: ", conditionMessage(m)); return(row) }
+  if (!identical(m$id, id)) { row$reason <- "plugin.json names a different id than its folder"; return(row) }
+  if (!identical(m$kind, kind)) { row$reason <- "plugin.json names a different kind than its folder"; return(row) }
+  files <- as.character(m$files %||% m$file %||% character(0))
+  if (!length(files) || !all(vapply(files, plugin_file_ok, logical(1)))) { row$reason <- "plugin.json lists no valid file"; return(row) }
+  spec <- PLUGIN_KINDS[[kind]]
+  if (!grepl(paste0("\\.", spec$extension, "$"), files[[1L]])) { row$reason <- paste0("the payload is not a .", spec$extension, " file"); return(row) }
+  row$name <- substr(as.character(m$name %||% id)[1L], 1L, 200L)
+  row$version <- as.character(m$version %||% "")[1L]
+  row$file <- files[[1L]]; row$files <- files
+  row$requires <- as.character(unlist(m$requires %||% character(0)))
+  row$source <- as.character(m$source %||% "")[1L]
+  row$license <- as.character(m$license %||% "")[1L]
+  row$installed <- as.character(m$installed %||% "")[1L]
+  if (is.na(row$name)) row$name <- id
+  for (f in files) {                                # a handful of files at most
+    p <- plugin_contained(dir, f)
+    if (is.null(p) || !file.exists(p)) { row$reason <- paste0(f, " is missing"); return(row) }
+    size <- file.info(p)$size
+    if (is.na(size) || size > spec$max_bytes) { row$reason <- paste0(f, " is larger than this kind allows"); return(row) }
+    row$bytes <- row$bytes + size
+  }
+  # Integrity: the recorded digest, recomputed. A manifest carrying sha256
+  # on an R that cannot compute it (< 4.5) is listed `verified = FALSE`
+  # rather than refused — the file is still the file; only the proof is
+  # unavailable here, and the row says so.
+  algo <- as.character(m$digest %||% if (!is.null(m$sha256)) "sha256" else if (!is.null(m$md5)) "md5" else "")[1L]
+  recorded <- if (identical(algo, "sha256")) m$sha256 else if (identical(algo, "md5")) m$md5 else NULL
+  can <- identical(algo, "md5") || (identical(algo, "sha256") && exists("sha256sum", asNamespace("tools")))
+  if (nzchar(algo) && !is.null(recorded) && can) {
+    for (f in files) {
+      want <- as.character(recorded[[f]] %||% "")
+      have <- if (identical(algo, "sha256")) unname(tools::sha256sum(file.path(dir, f))) else unname(tools::md5sum(file.path(dir, f)))
+      if (!nzchar(want) || !identical(tolower(want), tolower(have))) {
+        row$reason <- paste0(f, " has changed since it was installed (", algo, " differs)")
+        return(row)
+      }
+    }
+    row$verified <- TRUE
+  }
+  row$status <- "ok"
+  row
+}
+
+#' Every plugin in every layer, checked, one row each.
+#'
+#' @return data.frame(kind, id, name, version, layer, dir, file, requires
+#'   (";"-joined), files (";"-joined), source, license, installed, bytes, status, reason,
+#'   verified, active). `active` marks the copy consumers use: the first OK
+#'   copy of an id in layer order. Kinds the policy does not permit are not
+#'   listed at all.
+plugin_rows <- function(here, policy, kind = NULL) {
+  empty <- data.frame(kind = character(), id = character(), name = character(), version = character(),
+                      layer = character(), dir = character(), file = character(), files = character(), requires = character(),
+                      source = character(), license = character(), installed = character(), bytes = numeric(),
+                      status = character(), reason = character(), verified = logical(), active = logical(),
+                      stringsAsFactors = FALSE)
+  kinds <- if (is.null(kind)) policy$kinds else intersect(kind, policy$kinds)
+  rows <- list()
+  for (layer in plugin_layers(here, policy)) {       # three layers at most
+    for (k in kinds) {                               # a handful of kinds
+      kdir <- file.path(layer$dir, k)
+      if (!dir.exists(kdir)) next
+      ids <- sort(list.files(kdir, full.names = FALSE, no.. = TRUE))
+      ids <- ids[!startsWith(ids, ".") & dir.exists(file.path(kdir, ids))]
+      ids <- ids[grepl(PLUGIN_ID_RE, ids)]
+      rows <- c(rows, lapply(ids, function(id) plugin_inspect(layer, k, id)))
+    }
+  }
+  if (!length(rows)) return(empty)
+  out <- data.frame(
+    kind = vapply(rows, `[[`, character(1), "kind"), id = vapply(rows, `[[`, character(1), "id"),
+    name = vapply(rows, `[[`, character(1), "name"), version = vapply(rows, `[[`, character(1), "version"),
+    layer = vapply(rows, `[[`, character(1), "layer"), dir = vapply(rows, `[[`, character(1), "dir"),
+    file = vapply(rows, `[[`, character(1), "file"),
+    files = vapply(rows, function(r) paste(r$files, collapse = ";"), character(1)),
+    requires = vapply(rows, function(r) paste(r$requires, collapse = ";"), character(1)),
+    source = vapply(rows, `[[`, character(1), "source"), license = vapply(rows, `[[`, character(1), "license"),
+    installed = vapply(rows, `[[`, character(1), "installed"), bytes = vapply(rows, `[[`, numeric(1), "bytes"),
+    status = vapply(rows, `[[`, character(1), "status"), reason = vapply(rows, `[[`, character(1), "reason"),
+    verified = vapply(rows, `[[`, logical(1), "verified"),
+    stringsAsFactors = FALSE)
+  key <- paste(out$kind, out$id)
+  out$active <- out$status == "ok" & !duplicated(ifelse(out$status == "ok", key, paste0(key, "#", seq_len(nrow(out)))))
+  rownames(out) <- NULL
+  out
+}
+
+#' The active copy of one plugin, or NULL.
+plugin_active <- function(here, policy, kind, id) {
+  if (!plugin_kind_ok(kind) || !plugin_id_ok(id)) return(NULL)
+  rows <- plugin_rows(here, policy, kind)
+  hit <- rows[rows$id == id & rows$active, , drop = FALSE]
+  if (!nrow(hit)) return(NULL)
+  as.list(hit[1L, ])
+}
+
+#' The text of one manifest-listed file of an active plugin.
+plugin_read <- function(here, policy, kind, id, file = NULL) {
+  row <- plugin_active(here, policy, kind, id)
+  if (is.null(row)) return(list(ok = FALSE, error = "No such plugin."))
+  file <- file %||% row$file
+  listed <- strsplit(row$files, ";")[[1L]]
+  if (!plugin_file_ok(file) || !file %in% listed) return(list(ok = FALSE, error = "That file is not part of the plugin."))
+  path <- plugin_contained(row$dir, file)
+  if (is.null(path)) return(list(ok = FALSE, error = "That file is not inside the plugin."))
+  text <- tryCatch(paste(readLines(path, warn = FALSE, encoding = "UTF-8"), collapse = "\n"), error = function(e) NULL)
+  if (is.null(text)) return(list(ok = FALSE, error = "The file could not be read."))
+  list(ok = TRUE, kind = kind, id = id, file = file, name = row$name, text = text)
+}
+
+# ── fetching ────────────────────────────────────────────────────────────────
+
+#' Fetch one URL into `dest`, bounded, from a permitted host only.
+#' https everywhere but loopback (the test registry); the host must be on
+#' the policy's list. Returns "" or the reason.
+plugin_fetch <- function(policy, url, dest, max_bytes) {
+  if (!isTRUE(policy$network)) return(plugin_policy_reason(policy, "network"))
+  if (!is.character(url) || length(url) != 1L || is.na(url)) return("not a URL")
+  host <- url_host(url)
+  loopback <- host %in% c("127.0.0.1", "localhost")
+  if (!grepl("^https://", url) && !(loopback && grepl("^http://", url))) return("only https is fetched")
+  if (!nzchar(host) || !host %in% policy$sources) return(plugin_policy_reason(policy, "host"))
+  old <- options(timeout = PLUGIN_FETCH_TIMEOUT_S); on.exit(options(old), add = TRUE)
+  status <- tryCatch(
+    suppressWarnings(utils::download.file(url, dest, method = "libcurl", quiet = TRUE, mode = "wb")),
+    error = function(e) conditionMessage(e))
+  if (!identical(status, 0L)) {
+    unlink(dest)
+    return(if (is.character(status)) status else paste("download returned", status))
+  }
+  size <- file.info(dest)$size
+  if (is.na(size) || size > max_bytes) {
+    unlink(dest)
+    return(sprintf("the file is larger than this kind allows (%d KB)", as.integer(max_bytes / 1000)))
+  }
+  ""
+}
+
+# ── install and remove ──────────────────────────────────────────────────────
+
+plugin_stage_dir <- function(user_dir) {
+  staging <- file.path(user_dir, ".staging")
+  dir.create(staging, recursive = TRUE, showWarnings = FALSE, mode = "0700")
+  d <- tempfile("plugin-", tmpdir = staging)
+  dir.create(d, mode = "0700")
+  d
+}
+
+#' Install one plugin into the user layer.
+#'
+#' @param from one of list(registry = "<name>") · list(url = "<https://…>") ·
+#'   list(text = "<contents>", filename = "<name.ext>")
+#' @param complete install the plugins this one `requires` from the registry
+#'   (a dependent CSL style's parent). One level: a parent is independent.
+#' @return list(ok = TRUE, kind, id, name, version, file, requires,
+#'   already = FALSE) or list(ok = FALSE, error)
+plugin_install <- function(here, policy, kind, from, complete = TRUE) {
+  if (!plugin_kind_ok(kind)) return(list(ok = FALSE, error = "That is not a plugin kind this kernel has."))
+  if (!kind %in% policy$kinds) return(list(ok = FALSE, error = plugin_policy_reason(policy, "kind")))
+  if (!identical(policy$install, "user")) return(list(ok = FALSE, error = plugin_policy_reason(policy, "install")))
+  if (!is.list(from)) return(list(ok = FALSE, error = "`from` must say where the plugin comes from."))
+  spec <- PLUGIN_KINDS[[kind]]
+  ext <- paste0(".", spec$extension)
+
+  # The id and the source, from whichever door.
+  scalar <- function(x) is.character(x) && length(x) == 1L && !is.na(x)
+  if (scalar(from$registry)) {
+    if (is.null(spec$registry)) return(list(ok = FALSE, error = "That plugin kind has no registry to fetch by name from."))
+    id <- from$registry
+    if (!plugin_id_ok(id)) return(list(ok = FALSE, error = "That is not a name from the registry."))
+    source <- paste0(spec$registry()$base, id)
+    door <- "registry"
+  } else if (scalar(from$url)) {
+    source <- from$url
+    id <- sub(paste0("\\", ext, "$"), "", basename(sub("[?#].*$", "", source)))
+    if (!plugin_id_ok(id)) return(list(ok = FALSE, error = "The URL does not end in a name a plugin can have (lower-case letters, digits, . _ -)."))
+    door <- "url"
+  } else if (scalar(from$text) && scalar(from$filename)) {
+    fname <- from$filename                     # a picked file's own name: a path in it is not a name
+    if (!plugin_file_ok(fname) || !grepl(paste0("\\", ext, "$"), fname, ignore.case = TRUE)) {
+      return(list(ok = FALSE, error = paste0("The file must be a ", ext, " file with a plain name.")))
+    }
+    id <- tolower(sub(paste0("\\", ext, "$"), "", fname, ignore.case = TRUE))
+    if (!plugin_id_ok(id)) return(list(ok = FALSE, error = "The file's name is not one a plugin can have (lower-case letters, digits, . _ -)."))
+    if (nchar(from$text, type = "bytes") > spec$max_bytes) return(list(ok = FALSE, error = "The file is larger than this kind allows."))
+    source <- paste0("file:", fname)
+    door <- "text"
+  } else {
+    return(list(ok = FALSE, error = "`from` must be a registry name, a URL, or a file's text."))
+  }
+
+  # A shipped or system copy of that id is already the plugin: nothing to
+  # write, and the answer says so. (A user copy IS replaced — that is how a
+  # style is updated.)
+  rows <- plugin_rows(here, policy, kind)
+  have <- rows[rows$id == id & rows$active & rows$layer != "user", , drop = FALSE]
+  if (nrow(have)) {
+    return(list(ok = TRUE, kind = kind, id = id, name = have$name[[1L]], version = have$version[[1L]],
+                file = have$file[[1L]], requires = strsplit(have$requires[[1L]], ";")[[1L]], layer = have$layer[[1L]],
+                already = TRUE))
+  }
+
+  user_dir <- plugin_user_dir()
+  dir.create(file.path(user_dir, kind), recursive = TRUE, showWarnings = FALSE, mode = "0700")
+  stage <- plugin_stage_dir(user_dir)
+  on.exit(unlink(stage, recursive = TRUE, force = TRUE), add = TRUE)
+  file <- paste0(id, ext)
+  target_tmp <- file.path(stage, file)
+  if (identical(door, "text")) {
+    ok <- tryCatch({ writeLines(from$text, target_tmp, useBytes = TRUE, sep = ""); TRUE }, error = function(e) FALSE)
+    if (!ok) return(list(ok = FALSE, error = "Could not write the file."))
+  } else {
+    err <- plugin_fetch(policy, source, target_tmp, spec$max_bytes)
+    if (nzchar(err)) return(list(ok = FALSE, error = paste0("Could not fetch ", id, ": ", err)))
+  }
+  Sys.chmod(target_tmp, "0600")
+  v <- spec$validate(stage, file)
+  if (!isTRUE(v$ok)) return(list(ok = FALSE, error = paste0(id, " ", v$error, ".")))
+
+  # What it renders through, completed from the registry — once, before
+  # this one lands, so a plugin never sits installed with a missing parent.
+  requires <- as.character(v$requires %||% character(0))
+  for (req in requires) {                                    # one parent at most in practice
+    if (!is.null(plugin_active(here, policy, kind, req))) next
+    if (!isTRUE(complete) || is.null(spec$registry)) {
+      return(list(ok = FALSE, error = paste0(id, " renders through ", req, ", which is not on this machine.")))
+    }
+    r <- plugin_install(here, policy, kind, list(registry = req), complete = FALSE)
+    if (!isTRUE(r$ok)) return(list(ok = FALSE, error = paste0("Could not complete ", id, ": ", r$error)))
+    if (length(r$requires)) {
+      plugin_remove(here, policy, kind, req)
+      return(list(ok = FALSE, error = paste0(req, " is not an independent plugin; ", id, " was not installed.")))
+    }
+  }
+
+  manifest <- plugin_manifest_for(stage, kind, id, file, v, source, spec$license)
+  plugin_manifest_write(stage, manifest)
+  Sys.chmod(file.path(stage, PLUGIN_MANIFEST), "0600")
+
+  # Into place, atomically: the staged folder is renamed onto the id. An
+  # existing user copy is moved aside first and removed after, so at no
+  # instant is there half a plugin at that path.
+  dest <- plugin_contained(file.path(user_dir, kind), id)
+  if (is.null(dest)) return(list(ok = FALSE, error = "The plugin's folder would fall outside the user layer."))
+  old <- NULL
+  if (dir.exists(dest)) {
+    old <- tempfile("plugin-old-", tmpdir = file.path(user_dir, ".staging"))
+    if (!file.rename(dest, old)) return(list(ok = FALSE, error = "Could not replace the existing copy."))
+  }
+  if (!file.rename(stage, dest)) {
+    if (!is.null(old)) file.rename(old, dest)
+    return(list(ok = FALSE, error = "Could not move the plugin into place."))
+  }
+  if (!is.null(old)) unlink(old, recursive = TRUE, force = TRUE)
+  on.exit(NULL)                                               # staged folder is now the plugin; nothing to clean
+  list(ok = TRUE, kind = kind, id = id, name = manifest$name, version = manifest$version,
+       file = file, requires = requires, layer = "user", already = FALSE)
+}
+
+#' Remove one plugin from the user layer. A shipped or system plugin is not
+#' the person's to remove; a plugin another user plugin renders through
+#' stays until that one goes.
+plugin_remove <- function(here, policy, kind, id) {
+  if (!plugin_kind_ok(kind) || !plugin_id_ok(id)) return(list(ok = FALSE, error = "That is not a plugin."))
+  if (!identical(policy$install, "user")) return(list(ok = FALSE, error = plugin_policy_reason(policy, "install")))
+  rows <- plugin_rows(here, policy, kind)
+  mine <- rows[rows$id == id & rows$layer == "user", , drop = FALSE]
+  if (!nrow(mine)) {
+    if (any(rows$id == id)) return(list(ok = FALSE, error = "That plugin is part of this deployment; it cannot be removed here."))
+    return(list(ok = FALSE, error = "No such plugin."))
+  }
+  needs <- rows[rows$layer == "user" & rows$id != id &
+                  vapply(strsplit(rows$requires, ";"), function(r) id %in% r, logical(1)), , drop = FALSE]
+  if (nrow(needs)) return(list(ok = FALSE, error = paste0(needs$name[[1L]], " renders through it; remove that one first.")))
+  dest <- plugin_contained(file.path(plugin_user_dir(), kind), id)
+  if (is.null(dest)) return(list(ok = FALSE, error = "That plugin's folder is outside the user layer."))
+  unlink(dest, recursive = TRUE, force = TRUE)
+  list(ok = TRUE, kind = kind, id = id)
+}
+
+#' What the policy and the layers are, for the page: disclosure, never hidden.
+plugin_policy_disclosure <- function(here, policy) {
+  layers <- plugin_layers(here, policy)
+  list(
+    set = isTRUE(policy$set),
+    source = if (identical(policy$source, "env")) "environment" else if (nzchar(policy$source)) "file" else "",
+    install = policy$install,
+    network = isTRUE(policy$network),
+    sources = I(as.character(policy$sources)),
+    kinds = I(as.character(policy$kinds)),
+    note = policy$note,
+    layers = I(lapply(layers, function(l) list(name = l$name, dir = l$dir, writable = isTRUE(l$writable), exists = dir.exists(l$dir)))),
+    kind_info = lapply(policy$kinds, function(k) list(
+      kind = k, label = PLUGIN_KINDS[[k]]$label, consumer = PLUGIN_KINDS[[k]]$consumer,
+      extension = PLUGIN_KINDS[[k]]$extension, max_bytes = PLUGIN_KINDS[[k]]$max_bytes,
+      registry = !is.null(PLUGIN_KINDS[[k]]$registry))) |> setNames(policy$kinds))
+}